Description
Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating system commands. Successful exploitation could lead to full compromise of the system�s confidentiality, integrity, and availability.
References (2)
Core 2
Core References
Vendor Advisory
https://me.sap.com/notes/3675151
Vendor Advisory
https://url.sap/sapsecuritypatchday
Scores
CVSS v3
8.4
EPSS
0.0138
EPSS Percentile
80.5%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (8)
SAP_SE/SAP Application Server for ABAP and SAP NetWeaver RFCSDK
7.54
SAP_SE/SAP Application Server for ABAP and SAP NetWeaver RFCSDK
7.77
SAP_SE/SAP Application Server for ABAP and SAP NetWeaver RFCSDK
7.89
SAP_SE/SAP Application Server for ABAP and SAP NetWeaver RFCSDK
7.93
SAP_SE/SAP Application Server for ABAP and SAP NetWeaver RFCSDK
9.16
SAP_SE/SAP Application Server for ABAP and SAP NetWeaver RFCSDK
KERNEL 7.53
SAP_SE/SAP Application Server for ABAP and SAP NetWeaver RFCSDK
KRNL64UC 7.53
SAP_SE/SAP Application Server for ABAP and SAP NetWeaver RFCSDK
NWRFCSDK 7.50
Published
Jan 13, 2026
Tracked Since
Feb 18, 2026